From 75356c64a2b13a89497bd8125c1bfe79293084f9 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Wed, 13 Feb 2019 17:18:21 +0100
Subject: [PATCH] Remove deprecated CSP child-src

It's been probably long enough since
https://github.com/FreshRSS/FreshRSS/pull/1099
---
 app/FreshRSS.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/FreshRSS.php b/app/FreshRSS.php
index 9371081e4..1dc80718e 100644
--- a/app/FreshRSS.php
+++ b/app/FreshRSS.php
@@ -117,7 +117,7 @@ class FreshRSS extends Minz_FrontController {
 					}
 				}, FreshRSS_Context::$user_conf->sharing));
 				$connectSrc = count($urlToAuthorize) ? sprintf("; connect-src 'self' %s", implode(' ', $urlToAuthorize)) : '';
-				header(sprintf("Content-Security-Policy: default-src 'self'; child-src *; frame-src *; img-src * data:; media-src *%s", $connectSrc));
+				header(sprintf("Content-Security-Policy: default-src 'self'; frame-src *; img-src * data:; media-src *%s", $connectSrc));
 				break;
 			case 'stats':
 				header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'");